CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2024-32498 – OpenStack: malicious qcow2/vmdk images
https://notcve.org/view.php?id=CVE-2024-32498
03 Jul 2024 — An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled... • https://launchpad.net/bugs/2059809 • CWE-400: Uncontrolled Resource Consumption CWE-552: Files or Directories Accessible to External Parties •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1141 – Glance-store: glance store access key logged in debug log level
https://notcve.org/view.php?id=CVE-2024-1141
01 Feb 2024 — A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled. Se encontró una vulnerabilidad en python-glance-store. El problema ocurre cuando el paquete registra la clave de acceso para el almacén de vistazo cuando el nivel de registro DEBUG está habilitado. It was discovered that Glance_store incorrectly handled logging when the DEBUG log level is enabled. • https://access.redhat.com/errata/RHSA-2024:2732 • CWE-779: Logging of Excessive Data •
CVSS: 2.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-4134
https://notcve.org/view.php?id=CVE-2022-4134
06 Mar 2023 — A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. • https://bugs.launchpad.net/glance/+bug/1990157 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 7.7EPSS: 0%CPEs: 8EXPL: 1CVE-2022-47951 – openstack: Arbitrary file access through custom VMDK flat descriptor
https://notcve.org/view.php?id=CVE-2022-47951
26 Jan 2023 — An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. Se descubrió un problema en OpenStack Cinder antes ... • https://launchpad.net/bugs/1996188 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-552: Files or Directories Accessible to External Parties •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8234
https://notcve.org/view.php?id=CVE-2015-8234
29 Mar 2017 — The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision. El algoritmo de firma de imagen en OpenStack Glance 11.0.0 permite a atacantes remotos evitar el proceso de verificación de firma a través de una imagen manipulada, lo que desencadena en una colisión MD5. • http://seclists.org/oss-sec/2015/q4/303 • CWE-310: Cryptographic Issues •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7200
https://notcve.org/view.php?id=CVE-2017-7200
21 Mar 2017 — An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service. Un problema SSRF ha sido descubierto en OpenStack Glance en versiones anteriores a Newt... • http://www.securityfocus.com/bid/96988 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 3%CPEs: 1EXPL: 0CVE-2016-8611 – HP Security Bulletin HPSBGN03676 1
https://notcve.org/view.php?id=CVE-2016-8611
16 Nov 2016 — A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation. Se ha encontrado una vulnerabilidad en Openstack Glance. No se aplican límites en el servicio de imagen Glance para las v1 y v2 del método POST de la API "/images" para usuarios autenticados. Esto resulta en posibles ataques de denegación de servicio (DoS) ... • http://seclists.org/oss-sec/2016/q4/266 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 5%CPEs: 8EXPL: 1CVE-2015-5162 – openstack-nova/glance/cinder: Malicious image may exhaust resources
https://notcve.org/view.php?id=CVE-2015-5162
07 Oct 2016 — The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. El analizador de imagen en OpenStack Cinder 7.0.2 y 8.0.0 hasta la versión 8.1.1; Glance en versiones anteriores a 11.0.1 y 12.0.0; y Nova en versiones anteriores a 12.0.4 y 13.0.0 no limita adecuadamente las llamadas a qemu... • http://rhn.redhat.com/errata/RHSA-2016-2923.html • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-0757 – openstack-glance: Glance image status manipulation through locations
https://notcve.org/view.php?id=CVE-2016-0757
29 Feb 2016 — OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image. OpenStack Image Service (Glance) en versiones anteriores a 2015.1.3 (kilo) y 11.0.x en versiones anteriores a 11.0.2 (liberty), cuando show_multiple_locations está habilitado, permiten a usuarios remotos autenticados cambiar el estado de imagen y cargar ... • http://rhn.redhat.com/errata/RHSA-2016-0309.html • CWE-284: Improper Access Control CWE-285: Improper Authorization •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5286 – openstack-glance: Storage overrun by deleting images
https://notcve.org/view.php?id=CVE-2015-5286
16 Oct 2015 — OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623. OpenStack Image Service (Glance) en versiones anteriores a 2014.2.4 (juno) y 2015.1.x en versiones anteriores a 2015.1.2 (kilo) permite a u... • http://rhn.redhat.com/errata/RHSA-2015-1897.html • CWE-264: Permissions, Privileges, and Access Controls CWE-400: Uncontrolled Resource Consumption •